FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2025-04-11 06:28:22 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
6c083cf8-4830-11e4-ae2c-c80aa9043978	fish -- local privilege escalation and remote code execution Fish developer David Adam reports: This release fixes a number of local privilege escalation vulnerability and one remote code execution vulnerability. Discovery 2014-09-28 Entry 2014-09-29 fish >= 1.6.0 lt 2.1.1 http://www.openwall.com/lists/oss-security/2014/09/28/8 CVE-2014-2905 https://github.com/fish-shell/fish-shell/issues/1436 CVE-2014-2906 CVE-2014-3856 https://github.com/fish-shell/fish-shell/issues/1437 CVE-2014-2914 https://github.com/fish-shell/fish-shell/issues/1438 CVE-2014-3219 https://github.com/fish-shell/fish-shell/issues/1440
a3b10c9b-99d9-11ed-aa55-d05099fed512	shells/fish -- arbitrary code execution via git Peter Ammon reports: fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt. Discovery 2021-12-26 Entry 2023-01-21 fish >= 3.1.0 lt 3.4.0 CVE-2022-20001 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20001

VuXML ID

Description

6c083cf8-4830-11e4-ae2c-c80aa9043978

fish -- local privilege escalation and remote code execution

Fish developer David Adam reports:

This release fixes a number of local privilege escalation vulnerability and one remote code execution vulnerability.

Discovery 2014-09-28
Entry 2014-09-29
fish

>= 1.6.0 lt 2.1.1

http://www.openwall.com/lists/oss-security/2014/09/28/8
CVE-2014-2905
https://github.com/fish-shell/fish-shell/issues/1436
CVE-2014-2906
CVE-2014-3856
https://github.com/fish-shell/fish-shell/issues/1437
CVE-2014-2914
https://github.com/fish-shell/fish-shell/issues/1438
CVE-2014-3219
https://github.com/fish-shell/fish-shell/issues/1440

a3b10c9b-99d9-11ed-aa55-d05099fed512

shells/fish -- arbitrary code execution via git

Peter Ammon reports:

fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.

Discovery 2021-12-26
Entry 2023-01-21
fish

>= 3.1.0 lt 3.4.0

CVE-2022-20001
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20001